00:00:00.100-->00:00:05.806 >>Yeah we're long time Def Con listeners, first time Def Con talkers >>Yeah >>So I like that- 00:00:05.806-->00:00:12.012 that our slides are cut off cause it just says the internet already knows I'm x and you can 00:00:12.012-->00:00:18.085 fill in the blank um in this case it's pregnant um but that's historical I'm wasn't drinking 00:00:18.085-->00:00:23.090 while pregnant, just so you know [laughter] So I'm Kashmir, I'm a journalist, I've been writing 00:00:25.359-->00:00:30.831 about privacy and security for about ten years and I'm a new mother which is relevant 00:00:30.831-->00:00:36.036 information at this particular time >>Uh and I'm Cooper, I'm a technologist and security 00:00:36.036-->00:00:41.875 researcher at EFF uh I'm a privacy activist and I also care about privacy and security 00:00:41.875-->00:00:46.546 issues for people that have wombs despite not having one myself >>Woo! Yeah! [applause] 00:00:46.546-->00:00:51.551 >>Uh so we paired up for this particular project um I I'm an investigative journalist so I'm 00:00:55.822-->00:01:00.761 good at reading documents, and talking to people, and I'm also an immersion journalist, I like 00:01:03.130-->00:01:06.466 doing the things I'm writing about so when I wrote about bitcoin I lived on bitcoin for a 00:01:06.466-->00:01:11.471 week, it was hard um in the past with Def Con speakers help I hacked a smart home um so yeah I 00:01:13.774-->00:01:17.010 like to do the things I'm writing about though I did not get pregnant just to do this 00:01:17.010-->00:01:22.015 talk [laughter] >>Uh and I didn't either. So uh I'm a hacker so my skillset involves 00:01:25.118-->00:01:30.123 apparently seeing dogs and blondes in the matrix um but uh uh so I got interested in this 00:01:32.726-->00:01:37.731 um originally I ha- when I had um advised another journalist on an article about anti-abortion 00:01:40.267-->00:01:46.707 groups using uh geo targeting advertisements to target anti-abortion ads at women 00:01:46.707-->00:01:50.610 inside of Planned Parenthoods. >>So you'd be in Planned Parenthood planning to get an 00:01:50.610-->00:01:54.948 abortion, you fire up Facebook, and you get an ad telling you that you're- you know killing 00:01:54.948-->00:01:59.953 your fetus. >>Yeah. And so uh I met Kashmir and she uh pitched this idea to me um after uh she 00:02:02.489-->00:02:07.828 had unsuccessfully looked for a real security researcher for many months um and we settled on 00:02:07.828-->00:02:12.833 me so uh >>And beyond being pregnant I got interested in this um a few years ago I uh 00:02:15.635-->00:02:20.207 we're on the wrong slide, next one, oh we are missing the slide, anyways, a few years ago 00:02:20.207-->00:02:25.212 I helped popularize the story of uh the Target story. Um doe- is there anyone in here who doesn't 00:02:28.081-->00:02:32.419 know the Target data mining pregnancy story? Don't be afraid to raise your hands. Okay I'll 00:02:32.419-->00:02:37.224 tell it. Um almost everyone seems to know this story and I hear it come up at every single 00:02:37.224-->00:02:40.894 security conference, privacy security conference I go to so I'll be the one to raise it this 00:02:40.894-->00:02:45.799 time. But this is a story that came from an article written by Charles Duhigg who is a New York 00:02:45.799-->00:02:50.904 Times journalist um he did this big article on how companies learn your secrets and one of 00:02:50.904-->00:02:57.277 the anecdotes in this story was that Target did really excellent data mining, it would look at uh 00:02:57.277-->00:03:01.681 the shopping behavior of women to figure out who who- early on who is pregnant and it would be 00:03:01.681-->00:03:05.852 like they bought unscented lotion, they bought a blue carpet, they probably bought 00:03:05.852-->00:03:11.925 prenatal vitamins, which is like the big give away uh and so there was this story about how 00:03:11.925-->00:03:17.330 Target sent ads to this woman for all kinds of baby products and it turned out this woman was 00:03:17.330-->00:03:22.335 a teenager and her dad saw the ads and got really mad and went to Target and and was yelling at 00:03:22.335-->00:03:27.007 them saying are you trying to encourage my daughter to get pregnant and supposedly this dad 00:03:27.007-->00:03:31.845 called Target back a couple of weeks later and apologized and said there were things going on 00:03:31.845-->00:03:36.850 in his home uh that he didn't know about and that his daughter was indeed pregnant. So some 00:03:39.386-->00:03:44.724 people don't want uh the internet to know about their pregnancy um in particular 00:03:44.724-->00:03:48.628 there's a Princeton professor named Janet Vertesi and she wanted while she was pregnant 00:03:48.628-->00:03:54.568 for the internet not to find out about it. So she went to great lengths to hide her baby bump 00:03:54.568-->00:04:01.074 from the world of big data. She looked at baby sites, baby product sites, using Tor uh her 00:04:01.074-->00:04:07.614 husband went to uh the drug store, paid cash for gift cards when they wanted to buy baby 00:04:07.614-->00:04:12.452 products they would do it with these gift cards and have it sent to an Amazon locker so it 00:04:12.452-->00:04:17.758 wasn't associated with their home address and um she said she successfully hid it as far as 00:04:17.758-->00:04:22.662 she could tell because she never got online ads um uh targeted at her based on her pregnancy. I 00:04:22.662-->00:04:28.201 decided to do the opposite. I just told everybody I was pregnant [chuckles] I downloaded 00:04:28.201-->00:04:32.272 while I was trying to get pregnant, downloaded all of these period and fertility 00:04:32.272-->00:04:37.077 tracking apps and then once I got pregnant I entered into the apps I was pregnant and I just 00:04:37.077-->00:04:41.681 used an email address that I- I don't usually use in order to track what happened cause I 00:04:41.681-->00:04:47.120 wanted to find out who was going to sell me out to retailers who was gonna figure out that uh I 00:04:47.120-->00:04:52.726 was expecting. >>So uh this is the list of apps that we looked at uh and we looked at about err 00:04:52.726-->00:04:58.231 a little over 20 different apps um and they have all of these names a lot of them are named 00:04:58.231-->00:05:04.171 similar things like my calendar, my time, um [sighs] and uh >>So here's the first privacy issue 00:05:04.171-->00:05:09.976 >>Yeah so >>Once you put this on your phone and somebody is shoulder surfing, do they know 00:05:09.976-->00:05:14.848 what you're doing with these apps? >>So there's one set of logos that are very discreet, 00:05:14.848-->00:05:19.586 like you know, letters, numbers, this could all be pretty generic applications, ridesharing or 00:05:19.586-->00:05:25.325 something, there's the next tier though that involves a lot pink flowers and silhouettes of women 00:05:25.325-->00:05:30.764 >>I've never had so much pink on my smartphone [laughter] >>Uh and then there's yet a third 00:05:30.764-->00:05:35.769 tier of weird images of fetuses [laughter] >>At least the last one doesn't give away what the- 00:05:37.938-->00:05:43.777 the sex is of the baby >>And then of course the grand winner is this one [laughter] >>No I 00:05:43.777-->00:05:48.882 mean you don't necessarily know what this is, it could be like a porn app >>No, but it's called 00:05:48.882-->00:05:53.887 'Get Baby' [laughter] so yeah a little on the nose for this one. Um >>So I think that there's 00:05:57.691-->00:06:03.029 probably a few dudes in the audience who maybe haven't used these apps before and you may 00:06:03.029-->00:06:06.967 wonder why it is that women would want to tell their smart phone uh when they're having 00:06:06.967-->00:06:11.538 their period uh so these are some of the reasons why women use these apps uh the screenshot 00:06:11.538-->00:06:18.178 on the left you can't quite see it, but it give you options for for why you're using the app, it 00:06:18.178-->00:06:22.449 can be that you're trying to avoid pregnancy. So some women are using this as a 00:06:22.449-->00:06:28.655 contraceptive to avoid uh I guess the sperm getting to the egg during a fertile period. Um 00:06:28.655-->00:06:34.527 using it to get pregnant, or if they're getting very expensive IVF treatments, they can use 00:06:34.527-->00:06:39.833 these apps to track what's going on with their body. Uh once you get pregnant you can use these 00:06:39.833-->00:06:46.306 apps to track the human science experiment that's inside you uh the the main thing that the apps 00:06:46.306-->00:06:52.412 tell you about is what size fruit the fetus is in your body [laughter] which is super weird. 00:06:52.412-->00:06:57.817 >>Uh one of them told us that the baby was the size of a cheesy mango [laughter] which 00:06:57.817-->00:07:02.689 I'm not clear what a cheesy mango is >>[laughs] and it told us, it was not our- it was not 00:07:02.689-->00:07:07.694 our baby [laughter] >>No, no, yeah, [laughter] we should clarify >>[laughs] and then the 00:07:09.763-->00:07:15.568 other use for these apps is they have these community forums where women um talk about all 00:07:15.568-->00:07:20.674 kinds of things sometimes it's stuff having to do with pregnancy and fertility uh 00:07:20.674-->00:07:24.744 sometimes it's completely different, there's a lot of discussion about people's sex 00:07:24.744-->00:07:30.583 lives uh in the screenshots I have here it's about I can't even remember oh baby bump 00:07:30.583-->00:07:35.488 selfies, those are really big, oh there's somebody saying why is my period greenish black, 00:07:35.488-->00:07:41.494 which you should probably get out of the forums and go to the doctor [laughter] and then in 00:07:41.494-->00:07:46.333 terms to the kind of information that you give these apps um you might tell them what your 00:07:46.333-->00:07:51.304 vaginal discharge looks like um you'll because their fertility apps a very important piece of 00:07:51.304-->00:07:55.942 information is how often you're having sex and when you're having sex. Once you're pregnant 00:07:55.942-->00:08:00.413 you might tell them the physical symptoms that you're experiencing from you know 00:08:00.413-->00:08:06.953 headaches to back aches to not sleeping a lot uh and then the apps are helpful in terms of 00:08:06.953-->00:08:09.489 getting you to do things that you're supposed to do when you're pregnant like take 00:08:09.489-->00:08:14.594 prenatal envir- uh prenatal vitamins, do kegels , which if you don't know what that is you 00:08:14.594-->00:08:19.099 can look it up up [laughs] and just track your sleep and your weight like the usual kind of 00:08:19.099-->00:08:24.104 health tracking stuff. So I downloaded all these apps um who figured out I was pregnant? So 00:08:26.806-->00:08:32.846 one of the first uh one of the companies that figured out I was pregnant um was Twitter so this 00:08:32.846-->00:08:37.851 is from a uh a Twitter account that is associated with the email address that I used with 00:08:40.186-->00:08:44.457 all of these different apps and I don't know if it's included in the screenshots but they figured 00:08:44.457-->00:08:49.696 out that um this is from there's like a an interests page that you can get to in your Twitter 00:08:49.696-->00:08:54.167 settings and it tell you with like what advertisers know about you, how they're targeting you 00:08:54.167-->00:08:59.539 so I have been uh successfully associated with baby products, childcare products, and very 00:08:59.539-->00:09:04.477 specifically it says, dem- in my demographic information that I have one child. Which is true. 00:09:06.846-->00:09:12.552 Also all of these people figured out I was pregnant. Um this is my inbox at six months and um 00:09:12.552-->00:09:19.359 luckily again I was not using my usual email address uh but I had ads from pottery barn kids, uh 00:09:19.359-->00:09:24.364 What to Expect which is one of the apps I signed up for, Huggies and many many more. So 00:09:27.467-->00:09:32.505 this is where we get into my specialty um of reading documents so I wanted to figure 00:09:32.505-->00:09:37.377 out you know how these people had gotten this information, uh there was a technical way to fi- 00:09:37.377-->00:09:43.249 find that out and then there was just a read the privacy policy way so one of the uh- and I- I'm 00:09:43.249-->00:09:49.289 only going to be give you a few of the privacy policies but the first one was What to Expect. 00:09:49.289-->00:09:54.761 This privacy policy is 4 thousand words long which is 8 pages if you print it out, and 00:09:54.761-->00:10:01.534 2600 words in it very explicitly says you know we when you sign up we give your registration 00:10:01.534-->00:10:06.906 information to select partners and there's a little link there that you can click and then it 00:10:06.906-->00:10:12.145 gives you a list of the partners um when I first did this it was like 8 different companies but 00:10:12.145-->00:10:18.551 when I went back to the screenshots for our talk it had expanded to I think 14 um it 00:10:18.551-->00:10:23.590 includes pottery barn kids, huggies, uh, some of the people that you saw spamming my inbox, 00:10:23.590-->00:10:28.328 and the privacy policy said, if you don't want us to tell these companies about your- your 00:10:28.328-->00:10:33.333 pregnancy status uh don't use the app. Uh you know this can be worse than just getting spam in 00:10:36.236-->00:10:41.241 your inbox uh sometimes they send real mail uh similac is a baby formula maker and they're 00:10:43.610-->00:10:49.082 one of What to Expect's select partners and uh so they get information from What to Expect 00:10:49.082-->00:10:55.021 and other um companies that they wouldn't disclose to me uh and they will send a woman baby 00:10:55.021-->00:10:59.826 formula a couple of weeks before her due date so that she helpfully has baby formula 00:10:59.826-->00:11:04.764 around to feed to her child uh this can go very wrong because not everyone who gets pregnant 00:11:07.000-->00:11:13.606 stays pregnant so in one particular example a woman named Amy Pitman from Washington got 00:11:13.606-->00:11:18.745 pregnant, was excited about it, put it into the apps, um she didn't like the What to Expect 00:11:18.745-->00:11:23.750 app so she deleted it, and then she had a miscarriage, and uh a few months later, or I guess 00:11:26.252-->00:11:32.659 like 8 months later, she did get baby formula in the mail. So there is serious privacy harms 00:11:32.659-->00:11:38.164 here when you miss identify or correctly identify a woman's condition but then don't know 00:11:38.164-->00:11:42.368 what happens later. >>And it seems like a lot of these apps are not keeping in mind people 00:11:42.368-->00:11:48.074 who might be outside of the majority use case the average users story or the average 00:11:48.074-->00:11:52.946 threat model so to speak which is a theme that'll come up again >>Okay, so privacy policy number 00:11:52.946-->00:11:57.951 2, this was The Bump uh this privacy policy was 4700 words which is 10 pages printed out 00:12:00.086-->00:12:04.591 >>Yeah and so for reference, this is the same length as the entire report that I wrote about 00:12:04.591-->00:12:09.596 this problem >>[laughs] And so I was reading this privacy policy and I was really surprised to 00:12:11.598-->00:12:18.338 get about halfway through it and I discovered baby's first wiretap. Which [laughs] which I 00:12:18.338-->00:12:21.708 use facetiously I don't know if a lawyer would approve of calling this explicitly a 00:12:21.708-->00:12:27.981 wiretap but [laughs] it had a feature um it re- it told you that if you made a call from 00:12:27.981-->00:12:34.320 within the app like you um identified a vendor that you wanted to do your baby registry 00:12:34.320-->00:12:39.325 on. If you made a call from the app it would record the call um it would record any message that 00:12:42.128-->00:12:47.267 you left, it would um collect the phone number, the location where you were when you made the 00:12:47.267-->00:12:51.971 call, etcetera, which I just thought was insane, like I've never seen anything like that 00:12:51.971-->00:12:57.410 before with an app. And so I called up, I- I reached out the The Bump and I said you know, 00:12:57.410-->00:13:02.348 WTF. And they informed me oh you know we're not recording phone calls, that's legacy language 00:13:05.151-->00:13:11.291 for a contemplated future, for the Knot which is an app that they do uh for planning weddings 00:13:11.291-->00:13:17.397 and uh the press person was like I'll send that to our legal team right away eh so this proves 00:13:17.397-->00:13:22.802 that no one reads privacy policies, not even a company's own lawyers [laughter >>And the 00:13:22.802-->00:13:26.205 line >>They removed it from the privacy policy a couple days after I reached out to them 00:13:26.205-->00:13:32.845 >>The line of uh this bad thing you found was was uh just a just a test, how common was that 00:13:32.845-->00:13:36.516 >>Yeah I mean I'm sure of many people out here who have reached out to companies about privacy 00:13:36.516-->00:13:41.020 or security issues often gets a response of it was just a test or we were just temporarily 00:13:41.020-->00:13:45.124 doing it. I don't know I hear that all the time. >>That was response from about half of the 00:13:45.124-->00:13:50.129 companies we contacted I think. >>Okay this is the last one. Um so this was Ovia which is an app 00:13:52.732-->00:13:56.536 uh a company that makes a fertility app, a pregnancy tracking app, and even a child 00:13:56.536-->00:14:01.474 tracking app, their terms of use um uh are 6100 words which is 14 pages printed out. Um I don't 00:14:04.210-->00:14:08.081 know if you can see it in the screenshot but this is an app that gives you like a really 00:14:08.081-->00:14:12.385 helpful fertility score like your score is high, do it, your score is low, nothing's gonna 00:14:12.385-->00:14:18.491 come of it [laughter] and [laughs] when I went through their terms of use they uh you 00:14:18.491-->00:14:23.496 know a lot of these apps they sound like they're they're kind of like giving you the kind of 00:14:23.496-->00:14:27.567 advice that a doctor might give you um but many of the apps warn that they're not really giving 00:14:27.567-->00:14:32.805 you medical advice and this one explicitly said you know this app might be- might have errors, 00:14:32.805-->00:14:38.411 may be inaccurate just so you know we're not responsible for that. So I went back to look at 00:14:38.411-->00:14:45.118 their website and um oh yeah you can see it good. So in the advertisement for their 00:14:45.118-->00:14:50.857 pregnancy app they said they'll give you real time alerts when your symptoms are dangerous and 00:14:50.857-->00:14:55.161 right above that is like the little medical symbol. So I don't know it sounds like 00:14:55.161-->00:15:00.967 medical advice to me. >>Sure seem to be trying to imply that it's medical advice. >>Right., 00:15:00.967-->00:15:05.171 So these are some of the issues that we ran into um when it comes to inaccuracy the warning 00:15:05.171-->00:15:11.878 that they gave uh is warranted I found out that a year ago th- uh three doctors looked at a bunch 00:15:11.878-->00:15:18.151 of apps, 33 of the most popular ones on Android and iphone uh and they looked at their 00:15:18.151-->00:15:24.056 predictions for the fertile window and of those 33 apps, only 3 apps correctly predicted 00:15:24.056-->00:15:29.095 the fertile window um and we've got their results there. No one was completely off but they 00:15:29.095-->00:15:35.468 would just be off by like a few days and um interestingly the month that I got pregnant uh 00:15:35.468-->00:15:40.973 most of the apps told me I'd missed my fertile window so uh my husband and I were excited 00:15:40.973-->00:15:45.144 when we found out that in fact it had worked. >>So if you're using these to not get pregnant 00:15:45.144-->00:15:51.017 uh it might not be the best method >>Yeah, please don't use these apps as a contraceptive. 00:15:51.017-->00:15:56.222 Um so so far I've talked a lot about a one person that's involved in this in terms of 00:15:56.222-->00:16:02.862 privacy um there's- there's two people involved and so that was definitely on my mind as I was 00:16:02.862-->00:16:07.867 doing this project is that um well basically I've- I was tracking my now uh my now in the 00:16:12.772-->00:16:17.777 world daughter, online, since she was negative 8 months old uh [laughs] so I'm just wanted to 00:16:20.179-->00:16:25.184 say a public apology to Ellev. >>uh >>So so that's like a lot of what I was able to [laughter] 00:16:36.896-->00:16:41.901 [inaudible] [laughs] So this is uh- this is what I was able to learn just from um basically 00:16:45.905-->00:16:49.308 tapping into skills that I have as a journalist in terms of reviewing privacy policies, 00:16:49.308-->00:16:54.313 reaching out to companies, I also used an a-um an um an an app I guess called Recon from 00:16:56.482-->00:17:00.553 Northeastern University uh that monitored the kind of connections that my phone was 00:17:00.553-->00:17:05.424 trying to make and that these apps in particular were trying to make and so it told me 00:17:05.424-->00:17:09.195 essentially that there were a lot of advertisers that were getting information from the 00:17:09.195-->00:17:14.967 apps um but I felt like I needed more help in terms of really digging into the the the 00:17:14.967-->00:17:20.239 technical side of this and that's where Cooper came in. >>Yeah so I wanted to give sort 00:17:20.239-->00:17:25.278 of a hackers side of this and see what we could find out about uh the network traffic what was 00:17:25.278-->00:17:31.584 what sort of API calls were being made, whether encryption was being used, um, whether the 00:17:31.584-->00:17:36.722 APIs were written securely and what- what other companies were getting the data and what sort 00:17:36.722-->00:17:42.094 of data exactly they were getting. So uh >>Also Cooper is really good at finding memes 00:17:42.094-->00:17:47.466 [laughs] So you'll appreciate the next few slides >>So um the- one of the first fun things that 00:17:47.466-->00:17:53.272 I discovered about these apps is that uh they- they give you some pretty specific advice this one 00:17:53.272-->00:17:58.010 told me that I had a 2 point 6 percent risk for pregnancy, which is large considering I 00:17:58.010-->00:18:03.249 again, don't have a womb [laughter] >>So there is no option in these apps to say I'm- 00:18:03.249-->00:18:10.222 I'm a dude >>Yeah [laughs] um no so I used uh pretty typical reverse engineering methods, uh 00:18:10.222-->00:18:15.895 static analysis, dynamic analysis, uh and some other tools um so for static analysis 00:18:15.895-->00:18:20.900 I used a tool called JADX which is a decompiler for APK files uh produces something close to the 00:18:24.470-->00:18:29.709 original java source code it also uh extracts the resource files uh and then I loaded that 00:18:29.709-->00:18:35.247 up in android studio where I was able to do some similar things like what you can do in Ida I 00:18:35.247-->00:18:41.354 was able to um rename function calls that were obscured, track flows of functions, see where 00:18:41.354-->00:18:46.092 permissions were called, why they were called um so this gave me a lot of good insights into 00:18:46.092-->00:18:50.663 apps that I wasn't able to get just from network traffic um and this is how I got network 00:18:50.663-->00:18:56.469 traffic so for dynamic analysis I used a tool called man in the middle proxy or MITM proxy um 00:18:56.469-->00:19:02.375 and what MITM proxy does is it intercepts SSL traffic you uh install a special root 00:19:02.375-->00:19:07.646 certificate on your device and then you connect to the proxy and you can see um content, 00:19:07.646-->00:19:12.818 headers, and everything else, for HTTPS traffic and it also allows you to replay requests, 00:19:12.818-->00:19:18.824 edit requests and replay them so it was really good for uh looking at the APIs figuring out 00:19:18.824-->00:19:23.829 who was being contacted and what they were being sent. Uh and then the other tool I used is a 00:19:23.829-->00:19:28.567 proprietary tool called Kryptowire uh which they donated their services to us for this 00:19:28.567-->00:19:35.408 project uh so Kryptowire it does a combination of static and dynamic analysis uh and it 00:19:35.408-->00:19:40.413 allowed me to quickly um w- to- do sort of a quick triaging of about 40 different apps uh in a 00:19:43.282-->00:19:48.687 couple of hours to see uh sort of a high level overview of which ones might be worth 00:19:48.687-->00:19:54.560 looking into further. Um and you can see here this is kind of the like high level analysis screen 00:19:54.560-->00:19:59.565 of one of the apps uh where it told me that it was leaking uh personal information um so yeah 00:20:02.068-->00:20:07.073 so one of the main things that I found in most of these apps was uh just lack of HTTPS um so 00:20:10.476-->00:20:16.215 meaning that content- important personal content was sent over plain text html >>And so you 00:20:16.215-->00:20:20.252 might wonder like okay we're talking about the privacy and security of fertility apps, 00:20:20.252-->00:20:25.458 who's gonna attack these things like who wants to hack these, so let's think about um what kind 00:20:25.458-->00:20:30.930 of information is going into these apps, women talking about their sex lives, um, or the 00:20:30.930-->00:20:35.201 kinds of things that they're writing on the community forums where they're talking about 00:20:35.201-->00:20:40.639 issues that they're having with their pregnancy, medical information, um, again a lo- a 00:20:40.639-->00:20:45.344 lot of them talking about their sex lives, strangely a lot of women talking about um their 00:20:45.344-->00:20:49.982 experiences being sexually assaulted that was like a very common um topic of conversation 00:20:49.982-->00:20:54.420 so this is all being sent in the clear um and you might it might be intercepted by somebody who 00:20:54.420-->00:21:00.126 shares uh a network with you >>Yeah >>which could be your partner, uh could be your 00:21:00.126-->00:21:05.131 restrictive father, uh thanks to congress deciding not to move forward with privacy rules for 00:21:07.967-->00:21:12.037 ISPs this means your internet service provider could get this information and this would be 00:21:12.037-->00:21:17.543 more uh more information used to target you with ads. >>Yeah um and then the other thing about 00:21:17.543-->00:21:22.314 this is of course that somebody with man in the middle position could inject uh an execute 00:21:22.314-->00:21:28.821 javascript on a lot of these apps which used the uh web kit framework to render pages um 00:21:28.821-->00:21:34.827 related to that uh we found a number of issues with uh account hijacking ala uh firesheep so 00:21:34.827-->00:21:39.798 four of these apps would have been fire sheepable um so they were- which is to say that they 00:21:39.798-->00:21:45.538 were sending authentication cookies over plain text so Pink Pad, Webmd Baby, My Calendar, 00:21:45.538-->00:21:50.709 and The Bump um all were found to send authentication cookies over plain text >>So >>The top 00:21:50.709-->00:21:55.714 three have not fixed this >>So if you're using these apps and you're using Def Con wifi don't 00:21:57.950-->00:22:02.154 do those things at the same time >>yeah [laughter] probably just don't use the wifi [laughter] 00:22:02.154-->00:22:07.159 even if you're not using these apps. Uh we also found a lot of personal information leaks. So 00:22:09.395-->00:22:14.400 uh for Pink Pad and another- uh so Pink Pad is made by a company called Alt12 we tested two of 00:22:16.769-->00:22:23.108 their apps uh and both of them send your exact GPS coordinates to the Alt12 server every time 00:22:23.108-->00:22:29.848 you start the app um and why the hell does a period tracking app need to know your location? 00:22:29.848-->00:22:33.552 [laughs] >>And it's in their privacy policy it's so they can provide you with location based 00:22:33.552-->00:22:38.557 information, and ads. Location based ads. >>Yeah. uh so they- we also found a number of other 00:22:40.726-->00:22:47.666 things like email, name, gender, pregnancy status all being sent and I don't think that Pink Pad 00:22:47.666-->00:22:51.971 was the only one that was sending location uh a bunch of these apps requested the 00:22:51.971-->00:22:56.442 location permission but what we found w- uh through static analysis was that a lot of them 00:22:56.442-->00:23:02.581 were encrypting the data that was being sent uh to advertisers and to other people, Pink Pad 00:23:02.581-->00:23:06.151 was just the most obvious about it. And if we had more time maybe we would have found 00:23:06.151-->00:23:09.989 others. >>And so again thinking about the threat model here, I actually want you to put on your 00:23:09.989-->00:23:14.994 William Gibson hats um and think about the possibility for um what what could be done with 00:23:17.796-->00:23:23.736 information about women planning to be pregnant um or thinking about pregnancy um who are 00:23:23.736-->00:23:28.274 giving up their location details all the time um so I think at the beginning of this talk we 00:23:28.274-->00:23:33.846 made the point that advertisers um aren't just creepy because they get a lot of information 00:23:33.846-->00:23:37.650 about you and they're trying to get you to buy something um in the case of knowing a woman's 00:23:37.650-->00:23:44.189 pregnancy uh status it can be very malicious where we had an anti-abortion group targeting 00:23:44.189-->00:23:50.029 women that are in a Planned Parenthood waiting room so just think about some kind of a 00:23:50.029-->00:23:56.302 policy group who wants to target a bunch of women who live in a certain neighborhood um and tell 00:23:56.302-->00:24:01.006 them that they shouldn't get pregnant, like all everything that's bad about it or try to 00:24:01.006-->00:24:04.510 encourage them to get pregnant. >>And uh I don't know if Cory Doctorow is in here but if you 00:24:04.510-->00:24:10.716 write this story, we want royalties. [laughter] Um so uh and there were other information 00:24:10.716-->00:24:16.355 leaks too like uh this text file that was dropped on the SD card by one of the apps so this 00:24:16.355-->00:24:21.360 contains a log of the entries into the app every day uh and uh j- January 18th was a uh >>Like 00:24:23.529-->00:24:30.102 a really good day [laughter] >>But um this this this file being on the SD card means that 00:24:30.102-->00:24:34.273 any other app could read this file and furthermore it means that anybody who gets ahold of 00:24:34.273-->00:24:38.210 your SD card or the data partition on your phone is going to be able to read this file as 00:24:38.210-->00:24:43.215 well. So it's a pretty big privacy leak um and then of course third party tracking is a 00:24:45.718-->00:24:50.689 super common problem with all of these apps I think all but one of the apps that we tested 00:24:50.689-->00:24:55.561 contacted several different advertising servers um and it's mostly the same stuff that you 00:24:55.561-->00:25:00.499 see online uh the majority of it is Google, Facebook, um, Amazon, and um A- Adobe's various 00:25:03.736-->00:25:08.607 publishing networks and then there's like a long tail of uh just random advertisers and data 00:25:08.607-->00:25:14.646 brokers uh that are you know on one or two of them. >>So I think it's safe to say that Google, 00:25:14.646-->00:25:20.552 Facebook, Amazon, and Adobe know more about who in the- who in the country is pregnant than 00:25:20.552-->00:25:25.557 Target >>So one feature that all these- or that a lot of these apps have in common is this pin 00:25:27.693-->00:25:33.065 lock screen um and it's kind of interesting presumably to keep somebody from just picking up 00:25:33.065-->00:25:37.870 your phone and looking at it uh but they're not implemented very well uh they almost all have a 00:25:37.870-->00:25:44.543 for- 4 digit limit um and at the time that we looked at this none of them had any sort of 00:25:44.543-->00:25:48.947 protections against brute forcing so you could guess as many times as you wanted without 00:25:48.947-->00:25:54.253 any sort of slow down uh when we notified the companies one of the companies P Tracker did 00:25:54.253-->00:25:59.825 actually uh decide to fix that issue and implemented a uh back off for the number of times that 00:25:59.825-->00:26:05.030 you could enter the pin code uh but the other thing about these is that they don't have any sort 00:26:05.030-->00:26:10.369 of- they're not any sort of protection for the data at rest so they don't encrypt the data 00:26:10.369-->00:26:15.140 in any way, they don't do anything to actually protect it on the drive, they're just a uh 00:26:15.140-->00:26:19.578 intent that you have- that triggers before the app starts so all you have to do is get 00:26:19.578-->00:26:25.784 around that somehow and one way to get around that is to click this link that says I forgot my 00:26:25.784-->00:26:30.789 code so for at least one app uh The Bump when you click this link it sends you an email with 00:26:33.192-->00:26:37.963 a code- with a temporary pin code that will unlock the app >>And and where do those- you 00:26:37.963-->00:26:42.401 know where does email tend to go? >>And so email tends to go to your phone so if >>So if 00:26:42.401-->00:26:47.372 you're on the phone trying to get into the app and you can't because there's a pin on it 00:26:47.372-->00:26:52.511 >>Just send the reset code and uh check the email because you already have the phone and there 00:26:52.511-->00:26:57.015 you go so >>And when I- when I was using these apps I was not using pin codes I wasn't 00:26:57.015-->00:27:03.355 particularly concerned about um uh somebody getting into the apps uh but if- but if somebody 00:27:03.355-->00:27:08.660 does feel a need to use the pin they may have a very legitimate reason like they're >>You may be 00:27:08.660-->00:27:14.233 in an abusive relationship, you may be in a restrictive you know or a religious household, or a 00:27:14.233-->00:27:17.135 religious society. >>They're with somebody that they don't want somebody who has access to 00:27:17.135-->00:27:22.374 their phone to have access to their sex lives and so these pins should be stronger. >>Yeah 00:27:22.374-->00:27:28.280 and if you're relying on this pin code for security uh I don't recommend it uh you- you should 00:27:28.280-->00:27:33.285 um take better- other steps. Uh the other issue- another issue we found was files not actually 00:27:35.554-->00:27:42.528 being deleted uh and so again we only found this in The Bump but this is also largely because we 00:27:42.528-->00:27:46.598 ran out of time to do this research and this is probably an issue in other apps. So what 00:27:46.598-->00:27:52.204 happened this case is that um The Bump encourages you to upload poto- photos of your 00:27:52.204-->00:27:58.277 pregnanc- of your pregnancy progress. So a photo of your belly, a photo of um your- uh 00:27:58.277-->00:28:01.547 ultrasound >>And so what happens on a lot of these apps there's actually some apps that 00:28:01.547-->00:28:05.717 explicitly discourage this and say no posting any personal information in the community 00:28:05.717-->00:28:10.722 forums um but I guess The Bump didn't' have that prohibition so a lot of women like to post the 00:28:10.722-->00:28:14.426 ultrasound and share it so you can see the development of the baby but ultrasound pictures 00:28:14.426-->00:28:19.197 usually have uh the mother's full name, the hospital where the ultrasound was taken, the 00:28:19.197-->00:28:25.037 date, so a lot um of sensitive information so a woman might post that to a community forum 00:28:25.037-->00:28:30.442 and then realize all that she shared and delete it >>But when you delete it it turns out that 00:28:30.442-->00:28:35.747 it simply unlinks the photo from your account but doesn't actually delete it from the CDN 00:28:35.747-->00:28:40.886 server that the photo was uploaded to. So if you have that original URL that URL still 00:28:40.886-->00:28:46.658 works to see the photo for the rest of time um and we thought this might be a caching issue at 00:28:46.658-->00:28:52.364 first but the photo was still up for a week after I had deleted it from my account so definitely 00:28:52.364-->00:28:57.869 not a caching issue, just not even considered that a user might want to actually delete 00:28:57.869-->00:29:02.808 things when they say delete. Uh and then uh the other thing we found was just a crazy amount of 00:29:05.444-->00:29:09.247 permissions being requested uh it seems like the Android development philosophy is it's 00:29:09.247-->00:29:14.019 better to ask for all the permissions than for any forgiveness. Um no that was bad 00:29:14.019-->00:29:20.759 alright um so locat- so ten different apps, half of the apps we tested requested the location 00:29:20.759-->00:29:25.897 permission and again >>Everybody wants to know where you are when you're pregnant >>So again, for 00:29:25.897-->00:29:30.435 advertising right? But this harkens back to the story that I was working on earlier about uh 00:29:30.435-->00:29:34.673 women being targeted in Planned Parenthoods through location based advertising. This is 00:29:34.673-->00:29:40.345 incredibly personal information and there's no reason that any of these apps should have this. 00:29:40.345-->00:29:46.184 Um also a quarter of the apps we tested requested your contact list >>Just in case they wanna 00:29:46.184-->00:29:49.855 like inform people about the pregnancy >>Yeah they might want to text everybody you know that 00:29:49.855-->00:29:56.695 you're period is coming up. [laughter] um also five or six of the apps requested your 00:29:56.695-->00:30:03.235 device ID which is like a uh cookie for your phone it lets advertisers uh link your uh 00:30:03.235-->00:30:08.206 profile between different apps um and then the phone permission let's them do the same thing but 00:30:08.206-->00:30:13.578 using your IMEI which is like a hardware serial number for your phone. Um and then Pregnancy 00:30:13.578-->00:30:19.651 Plus requested the SMS permission and I have no idea why but it also has the contact 00:30:19.651-->00:30:24.456 permission so maybe that thing I said earlier about it texting everyone [laughter] anyway the 00:30:24.456-->00:30:29.461 other interesting uh so we found one interesting security feature was that four of these apps, 00:30:31.997-->00:30:37.002 Glow, Nurture, and Eve were all made by the same company and Clue all implement certificate 00:30:39.538-->00:30:44.543 pinning uh so this is where you hardcode the hash of the SSL certificate that you want to use 00:30:47.846-->00:30:52.918 for your uh HTTPS connection into the application um and it's pretty cool this- so this 00:30:52.918-->00:30:58.690 prevents somebody from doing a man in the middle attack on HTTPS like what I did with MITM 00:30:58.690-->00:31:05.030 proxy um and I mean it's a nice feature to have my bank doesn't even do this which would be 00:31:05.030-->00:31:10.102 great um but it's kind of extra like I don't >>We're not- We're not security shaming >>I'm not 00:31:10.102-->00:31:15.107 security shaming, I'm glad they did it, but uh TLS man in the middle seems like to not really 00:31:17.476-->00:31:22.481 be in the threat model for uh the use of these apps and it seems like maybe a better use of 00:31:22.481-->00:31:26.885 their time would be to implement something like two factor authentication uh which none of 00:31:26.885-->00:31:31.890 these apps did or securing that pin code thing. S- um so after finding all this uh we reached 00:31:35.727-->00:31:39.030 out to the- so we reached out to the vendors separately >>We reached out separately >>Yeah, 00:31:39.030-->00:31:43.568 so Kashmir reached out to them about the uh privacy issues and about the things in the um terms 00:31:43.568-->00:31:47.906 of service. I reached out to them about the security issues um this is how I felt about 00:31:47.906-->00:31:52.911 their response [laughter] um and this- this this dog will always be relevant forever [laughter] 00:31:55.580-->00:32:00.519 uh so I contacted uh nine different vendors um and uh all these guys and also The Bump um 00:32:02.754-->00:32:07.759 and we received a response back from P Tracker, Glow, and The Bump which isn't up there 00:32:09.995-->00:32:15.000 because we got a response back from them uh just- just after we finished these slides. Um who- 00:32:17.602-->00:32:23.241 so P Tracker and Glow fixed the issues that we found uh The Bump promised that they would fix the 00:32:23.241-->00:32:28.847 issues um and everyone else just completely ignored us once company sent us a form letter 00:32:28.847-->00:32:35.387 saying they- they appreciate that we like their application [laughter] >>I had a different 00:32:35.387-->00:32:40.759 experience and this is where it's just is different being uh a security uh technologist 00:32:40.759-->00:32:46.932 versus being a journalist. I heard back from everybody that I reached out to um except for 00:32:46.932-->00:32:52.137 Everyday Health um which makes the What to Expect app and Alt12 uh and people you know 00:32:52.137-->00:32:54.139 acknowledged the problems with uh the privacy policy and changed it um I just- I got 00:32:54.139-->00:32:56.141 responses and uh companies definitely seem to pay attention to journalists I think that it 00:32:56.141-->00:32:58.143 helps that they like press people set up particularly to receive our um our inquiries and 00:32:58.143-->00:33:00.078 also I think they better understand what journalists are asking them and sometimes they 00:33:00.078-->00:33:02.080 just have no idea um what a security technologist is sending their way. >>So maybe the lesson 00:33:02.080-->00:33:07.085 here is that if you want companies to take your security issues seriously either work 00:33:10.922-->00:33:15.927 with a journalist or tell them that you're a journalist >>Yeah, I definitely endorse this pair 00:33:24.803-->00:33:31.409 up you should definitely pair up with journalists if you're a technologist and vice versa. 00:33:31.409-->00:33:38.149 >>Um yeah so and on that line uh what can hackers do, what can you all do uh to improve this 00:33:38.149-->00:33:43.154 situation and one of the best things to do um is uh to pair up with a journalist and I might do 00:33:45.423-->00:33:49.628 these in kind of a reverse order- is to pair up with a journalist uh the combination of 00:33:49.628-->00:33:55.233 a hacker and an investigative journalist is a really powerful combination um you can- we can 00:33:55.233-->00:34:01.573 find these problems and then we can tell the world um and we can through shaming these companies, 00:34:01.573-->00:34:07.445 and through getting this publicity out there, convince them to take these security and 00:34:07.445-->00:34:12.217 privacy issues more seriously. Um and we're also- hackers are really good at threat modeling 00:34:12.217-->00:34:17.422 and we can think about uh threat models outside of sort of one's standard deviation from the 00:34:17.422-->00:34:22.627 average user so we can think about threat models for people that are in abusive household or 00:34:22.627-->00:34:27.565 people that have a stalker, right? These uh should be pretty common threat models for 00:34:27.565-->00:34:31.369 somebody writing one of these apps but they're apparently not >>I think one thing that was 00:34:31.369-->00:34:34.539 obvious to us at the end of this is that people that these companies hadn't necessarily 00:34:34.539-->00:34:40.845 thought about um kind of the abusive edge cases um and actually a year ago Glow had a 00:34:40.845-->00:34:45.884 really big security issue that consumer reports discovered where Glow had this feature 00:34:45.884-->00:34:50.422 there where you could invite your partner um to kind of monitor your fertility or 00:34:50.422-->00:34:56.127 pregnancy with you and the way they had set it up was such that the woman um would would uh make 00:34:56.127-->00:35:02.734 the invitation to somebody but um after she did that anybody who knew her email address could 00:35:02.734-->00:35:08.073 then monitor um what she was doing within the apps and so it was just this kind of huge 00:35:08.073-->00:35:11.843 security hole and only discovered because consumer reports decided to look really 00:35:11.843-->00:35:16.214 closely at the- at the app. >>But Glow did take that issue seriously and did fix the issue 00:35:16.214-->00:35:21.219 and had- I think is why they were so responsive to the security issues that we found 00:35:21.219-->00:35:25.790 because they do seem to after that shaming er after that publicity >>publicity [laughs] 00:35:25.790-->00:35:29.361 not shame >>Not shaming um but after that publicity they decided to take these issues 00:35:29.361-->00:35:34.366 seriously so this is a great illustration of how publicizing these problems um is a effective 00:35:39.704-->00:35:44.309 tactic for change. >>Um >>So Kashmir what was your takeaway from all of this? >>Yeah I mean 00:35:44.309-->00:35:50.315 my firsthand um opinion on all this like I hate to admit it but I really enjoyed using these 00:35:50.315-->00:35:55.320 apps um while while I was pregnant um it's super weird being pregnant uh it's like 00:35:57.722-->00:36:02.360 unlike anything that's ever happened to your body before and you- just- you feel like a 00:36:02.360-->00:36:07.298 science experiment for 9 months and so I appreciate the information I was getting from 00:36:07.298-->00:36:12.437 the apps uh but if I decide to have more children I don't think I would use the apps again cause 00:36:12.437-->00:36:17.842 now I kinda like know my way around it um so any any future children I would have the only 00:36:17.842-->00:36:23.148 priv- privacy invasion they'd be subjected to in utero would be the ultrasound which I like to 00:36:23.148-->00:36:26.851 call baby's first privacy invasion. >>It's always hardest on the first child isn't it 00:36:26.851-->00:36:31.589 Kashmir? >>Always hard- we're both first children, it's the hardest. >>Anyway um and so 00:36:31.589-->00:36:36.161 that's all we have. We wanna say some thanks to- uh thanks to Kryptowire for donating their 00:36:36.161-->00:36:40.965 analysis services to us uh we really appreciated that and it helped us out. >>Thanks to J- 00:36:40.965-->00:36:45.937 Dave and Jingjing at Northeastern for their help with Recon >>and uh thanks to Gizmodo 00:36:45.937-->00:36:50.308 and EFF for continuing to sign paychecks to us >>[laughs] Thanks to Def Con and then 00:36:50.308-->00:36:55.313 thanks to Ellev for inspiring our research [applause]